SC-900 Describe the capabilities of Microsoft Entra Practice Question
Exhibit
Refer to the exhibit. The exhibit shows a PowerShell command and its output:
```powershell
Get-MgPolicyConditionalAccessPolicy -Filter "DisplayName eq 'Block Legacy Auth'" | Format-List Id, DisplayName, Conditions
Id : 12345678-1234-1234-1234-123456789abc
DisplayName : Block Legacy Auth
Conditions : @{ClientAppTypes=System.Object[]; Applications=; Users=; Locations=; Platforms=; SignInRiskLevels=; UserRiskLevels=;}
```The exhibit shows a Conditional Access policy named 'Block Legacy Auth'. The admin notices that the policy is not blocking legacy authentication as intended. Based on the output, what is the most likely reason?
⚠ Common exam trap
Watch out — candidates often assume a Conditional Access policy with 'Block access' grant will automatically block all authentication, but they overlook the critical requirement to explicitly configure client app types to cover legacy protocols.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy does not have any client app types configured to block.
The policy is not blocking legacy authentication because it lacks configured client app types. Conditional Access policies require explicit selection of client apps (e.g., Exchange ActiveSync, other clients) to target legacy authentication protocols like POP3, IMAP, and SMTP. Without this configuration, the policy has no conditions to enforce, so it cannot block any authentication attempts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The policy name is incorrect.
Why it's wrong here
The question stem explicitly states "the exhibit shows a conditional access policy named block l," which implies the policy's name is clearly displayed as "Block Legacy Auth" or a similar variant in the exhibit. Therefore, asserting that the policy name itself is incorrect contradicts the premise that the name is visible and identifiable as intended for its purpose within the context of the provided exhibit.
- ✓
The policy does not have any client app types configured to block.
Why this is correct
For a Conditional Access policy to effectively target and block specific client application types, such as "Exchange ActiveSync clients" or "Other clients" (which often represent legacy authentication protocols), the `ClientAppTypes` condition must be explicitly configured. If this condition is empty or not selected, the policy will not apply to any particular client application type, thus failing to block legacy authentication attempts originating from those specific clients.
- ✗
The policy is assigned to no users.
Why it's wrong here
Conditional Access policies require user assignment to be effective. While the "Users" property might not be explicitly shown in a partial exhibit, it is highly improbable for a policy intended to block legacy authentication to be assigned to "No users." By default, or in common configurations, such a policy would typically target "All users" or specific groups to enforce its controls, making the statement that it's assigned to no users incorrect without explicit evidence.
- ✗
The policy is disabled.
Why it's wrong here
Conditional Access policies have a "State" property that indicates whether they are "On," "Off," or "Report-only." If a policy is merely listed as part of an exhibit without an explicit indication of its state being "Off" or "Disabled," it is generally assumed to be active or in report-only mode. A disabled policy would typically not be considered an active component of the security posture, and its state would be clearly indicated as such within the policy details.
Go deeper
Related to this question
Learn chapter
Authentication and MFA in Entra
Key term
SMTP
SMTP (Simple Mail Transfer Protocol) is the standard internet protocol used to send emails from a client to a server or between email servers.
Key term
Conditional Access policy
A Conditional Access policy is a set of rules in Microsoft Entra ID that automatically grants or blocks access to cloud apps based on signals like user identity, location, device health, and risk level.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.